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REMARKS 



Reconsideration of the above-identified application in view of the 
amendments above and the remarks following is respectfully requested. 

Claims 1-40, 49-59, 61 and 62 are pending in the Application. Claims 1-40, 
49-59, 61 and 62 have been rejected. Claims 1, 27, 28 and 49 have been amended 
herewith. Claim 26 has been cancelled herewith. Claims 41-48 and 60 have been 
cancelled in a previous communication. 

The Application now comprises, after amendments, claims 1-25, 27-40, 49-59, 
61 and 62, of which claims 1 and 49 are in independent form. 



The Examiner is thanked for the Interview kindly granted on May 27, 2009 
which helped the Applicants considerably in understanding the Examiner's 
requirements. Claim 1 was discussed in some detail and the Examiner pointed out 
certain clarity issues which have now been addressed by the present amendments. 

It is believed that the amendments to the clarity issues render the citations 
moot but the citations are nevertheless addressed for completeness. 

Amendments to Address the Clarity Issues Raised in the Interview 
Claim 1 is amended to clarify that there is a first relatively fast comparison, 
where the "relatively fast" is in relation to the second, relatively slower textual 
comparison. 

Claim 1 is further amended to specify that when the second match is also 
positive then a distribution policy is applied to the information sequence. 



The Examiner rejected claims 1-40, 49-59, 61 and 62, under 35 U.S.C. 
§ 103(a) as being obvious over Zuk et al (US Patent Application Publication No. 
2003/0154399 Al), referred herein after as 'Zuk 1 , in light of Singh (US Patent 
Application Publication No. 2004/0068526 Al). 

The claim rejections are respectfully traversed. 



Interview 



Claim Rejections - 35 U.S.C. SI 03 
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Claim 1 specifies that both the predetermined information items whose 
distribution it is desired to control and the information sequence it is desired to scan, 
are changed into a format that facilitates a first relatively fast comparison. This first, 
relatively fast comparison may be applied to the passing traffic, the information 
sequences, in general. Then, when the fast comparison signals a match, a second 
relatively slow detailed textual comparison is made to confirm the findings of the fast 
comparison. If the match is confirmed by the detailed comparison then it is 
concluded that the material it is desired to control is actually present in the 
information sequence and distribution is then subjected to any relevant distribution 
policy. 

The claim defines the above features as follows: 



determining the presence of one or more of said 
prestored information items within said transformed 
information sequence, said determining comprising: 

comparing said information sequence with said 
information item in said format facilitating said first 
relatively fast comparison; and 

if a match is found between said formats 
facilitating fast comparison then carrying out said 
second relatively slow textual comparison between said 
respective prestored information item and said extracted 
information sequence. 



It is clear from the above that the claim makes a specific requirement for a fast 
comparison based on the first format - the "format facilitating said first relatively fast 
comparison". 

It is clear that the claim defines a second stage, of relatively slow textual 
comparison. The fast and slow in the claim are defined relative to each other, and 
thus the claim provides an internally consistent definition system. 

The Examiner cites against this claim the paragraphs 24 and 25 of Zuk. 
Paragraphs 24 and 25 of Zuk teach about firewalls and intrusion detection systems 
(IDS). The passage states in general that an Information Disclosure Statement (IDS) 
may be used to "collect information from a variety of system and network resources to 
analyze the information for signs of intrusion". 
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However, the passage does not teach that the comparison is: 



determining the presence of one or more of said 
prestored information items within said transformed 
information sequence, said determining comprising: 

comparing said information sequence with said 
information item in said format facilitating said first 
relatively fast comparison; and 

if a match is found between said formats 
facilitating fast comparison then carrying out a second 
relatively slow textual comparison between said 
respective prestored information item and said extracted 
information sequence. 



In order to make a case against the claim the Examiner has to find the actual 
features claimed or prove that they are obvious. The teaching of collecting 
information from a variety of sources, does not anticipate or render obvious 
comparing said information sequence with said information items in said format 
facilitating said first relatively fast comparison, especially when that is followed by a 
second relatively slow textual comparison.. 

That is to say Zuk does not teach two-stage searching at relatively different 
speeds, certainly not where the first search is fast relative to the second textual search. 

Regardless of the above, he does not control distribution of predetermined 
information items based on such a search. He simply protects an internal environment 
from a harmful exterior via a firewall. 

Thus even if Singh were to be combined with Zuk, there is still a failure to 
teach two stage searching. Singh does not carry out two-stage searching and Zuk does 
not carry out comparison at all, much less two stage searching. 

Even if Singh were combined with Zuk, the second stage of the search is not 
taught since Singh does not carry out a textual comparison, as defined in the claim. 
Zuk does not carry out either a rapid search comparison or a textual comparison, and 
indeed carrying out a textual comparison would not be relevant to Zuk, who is merely 
checking for protocol anomalies that might indicate an attack. 

In looking for harmful packets, exact text comparison is useless. So such a text 
comparison is not taught either by Zuk, or by Singh, nor would it be obvious to the 
skilled person reading the combination. 
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In summary Zuk paragraph 24-25 does not teach a textual comparison as 
claimed, or a canonical form comparison. Singh only teaches canonical form. Thus 
no-one teaches a textual comparison at all 

Even if they did teach a textual comparison, neither Singh nor Zuk teach a 
two-stage comparison. 

Even if they did teach a two stage comparison, they do not teach a two stage 
comparison where the first stage is a fast comparison relative to the second stage 
which is a textual comparison. 

Thus the skilled person would not know that the textual comparison should be 
made the second stage in a two stage search. 

Neither does the skilled person learn that the canonical form comparison 
should be made the first stage in a two-stage comparison. 

Indeed he does not learn that a textual stage is required at all, since a textual 
stage cannot be inferred from paragraph 24 or 25 of Zuk, which merely teaches 
searching through resources in the most general sense. Thus the skilled person is 
unable to infer that there should be a two-stage comparison in the first place. 

The Examiner argues, page two last two lines, "Furthermore, nowhere in 
claim 1 is there support for the argument of information being compared". However 
claim 1 explicitly defines a first stage of comparing the information sequence with the 
prestored information items based on the format for rapid searching, and a second 
stage of a textual comparison. 

Irrespective of the above, the Examiner claims to have found the claimed 
feature of "transforming said information sequence obtained from said digital medium 
into said format facilitating fast comparison in accordance with said transformation 
format" in paragraph 10 of Zuk. However, paragraph 10 refers to spoofing of IP 
addresses. It merely teaches translating of source addresses to different source 
addresses, that is to say without any transformation format. It is well known to the 
skilled person that there is only a single format for IP addresses. Hence Zuk 
paragraph 10 does not teach a transformation format, contrary to the claimed feature. 
That is to say this claimed feature requires a transformation carried out in accordance 
with a transformation format. Spoofing of addresses is just a straightforward 
translation and there is no transformation format either taught or hinted at in Zuk. 



* 
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Furthermore contrary to the requirement of the claim, the whole point of 
address spoofing in paragraph 10 is that the information (of the original address) is 
lost, whereas the claim requires that information is that used in the later two-stage 
searching. That is to say the information translation of paragraph 10 of Zuk would fail 
to support the later stages of the claim where comparison is carried out, since in Zuk 
the information has been lost, making searching meaningless. 

The above arguments are believed to apply mutatis mutandis to claim 49, to 
which the same amendments have been made. Claim 49 is thus now believed to be 
allowable for the same reasons. 

The dependent claims are believed to be allowable as being dependent on 
allowable main claims. 

All of the matters raised by the Examiner have been dealt with and are 
believed to have been overcome. 

In view of the foregoing, it is respectfully submitted that all the claims now 
pending in the application are allowable. An early Notice of Allowance is therefore 
respectfully requested. 



Respectfully submitted, 




Martin D. Moynihan 
Registration No. 40,338 



Date: June 23, 2009 



Enclosures: 



Request for Continued Examination (RCE); and 
Petition for Extension of Time (3 Months) 



